Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

351–360 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#351

Post by bjornjaja »

m00x wrote: post #334
z3t4 wrote: post #275

Earlier quoted context omitted.

Software should be secure by default. Don't blame the user. mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add another user if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password and allow it to login from a public IP. So you really thi…

This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 . Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL inj…

Honestly a lot of the problem is: people aren’t studying systems engineering OR security. Look at all the “learn to code in 21 days” BS and all the code academies.

There’s so much emphasis on abstracting away the systems with cloud-this and elastic-that and developers don’t know much about general systems engineering.

My recommendation to software developers: take the Network+ and Security+ exams at the bare minimum.

Honestly as much as people complain about process getting in the way of things, there should be checks and balances at any business that deals with personal information. Finance institutions are heavily regulated—these fkers should be held accountable.

Re: Personal and social information of 1.2B people discovered in data leak

#353

Post by Thriptic »

btrettel wrote: post #71
Thriptic wrote: post #49

Earlier quoted context omitted.

> I want someone to start an opt-out service, where I send them $20, and they send a book of names by registered mail for opt-outs every month This exists but it's not cheap: https://www.abine.com/deleteme/

I'm not rich but $129/year isn't bad. I'd hesitate mostly because I assume such services are scams.

It's a legit service. I use them and they did ensure that my data was removed from the services they specified. Obviously I'm just some person on the internet so my statement has no intrinsic credibility, but I believe they were also validated in a nyt article awhile back.

Re: Personal and social information of 1.2B people discovered in data leak

#354

Post by jka »

There's a video at https://www.youtube.com/watch?v=VNLEEogFo18 where People Data Labs' chief executive speaks at an insurance conference this year about their business.

They describe the data as being sourced from a 'data co-op' of over 1k companies which share data. It wasn't clear whether that means that those companies are collaborating and pooling data, or whether it's a roundabout/wordy way of saying that they scrape public personal information from thousands of sites.

They also claim that they're GDPR and CCPA compliant; I'm no expert but I do find one or two references that seem to suggest that scraping EU citizens' personal data without consent hasn't been GDPR-compliant for some time.

It does also raise another question: even if PDL themselves aren't GDPR-compliant, would any resulting fines against them reclaim a significant portion of the utility captured from the distribution of that data? As per comments on this thread, PDL API keys seem to be free to create.

Hypothetically speaking it could be within the interests of a group of businesses to provide a small amount of funding towards operation(s) that harvest and redistribute personal data: if the revenue base is low, the operation(s) can eventually fail (once legal proceedings catch up with them) and the group as a whole incurs little cost.

The speaker also takes a question from the audience regarding potential use-cases for this kind of personal data, and answers that knowing about an individual's life events (such as marriage) can be an opportunity to sell products to them, as can differentiating pricing if they'd just started smoking cigarettes.

Although I'm no expert, my understanding of insurance has been that risk is spread across a large pool of customers, allowing them each to pay similar premiums despite potentially slightly different backgrounds, with the understanding that they mutually benefit by paying into a shared fund so that the (random, potentially high-cost) risk of loss to each member is greatly softened.

We're seeing a situation here where more precise, per-individual data is being collected across large populations and could potentially be used for price differentiation.

If the insurance industry doesn't defend itself, this could lead to premiums which are essentially calculations based on 'pre-existing data' -- information which the consumer may not have consented to sharing, and which an insurance company might not be able to collect from application forms.

We don't seem to be particularly good, collectively, at escaping from cycles which seem to introduce or further wealth disparity at the moment and I worry that this kind of tech-driven attempt to optimize revenue efficiency of the insurance industry would only lead to further inequality.

Re: Personal and social information of 1.2B people discovered in data leak

#355

Post by class4behavior »

slg wrote: post #227

The number in the HN headline was changed from 1.2 billion to 1 billion (despite the original source's headline saying 1.2). It is kind of amazing that leaking the personal data of 200 million people is now just a rounding error that can be dropped from headlines.

Imho, it's more impressive that it's basically a non-story outside of it security news.

Re: Personal and social information of 1.2B people discovered in data leak

#356

Post by peteretep »

jwandborg wrote: post #324
cobookman wrote: post #222

Earlier quoted context omitted.

There's something called defense in depth. Even with ES deployed in an environment with proper network firewall rules...etc, I'd still want some sort of authentication/RBAC

"Defense in depth" sounds, to me, like a phrase to justify multiple layers of imperfect security. A single layer of cloth might not hold water, adding more layers of cloth may hold water for longer, but it's probably more cost effective to start with the right material.

> "Defense in depth" sounds, to me, like a phrase to justify multiple layers of imperfect security.

That’s absolutely correct! But you seem to be missing the fact that _all_ layers of security are always imperfect.

Re: Personal and social information of 1.2B people discovered in data leak

#357

Post by prawnsalad »

kaivi wrote: post #181
davidhyde wrote: post #134

Earlier quoted context omitted.

You forgot the part about exposing your finished database to unprotected elasticsearch http endpoint ;) In all seriousness does anyone know why you can even host an elasticsearch database as http and without credentials? Seems to be the default. What is the use case for this?

Tbh I'm still selling that data. For a while I've had reoccurring nightmares that my DB had been stolen and published together with an article on how stupid and incompetent I am.

If I've understood you right, you break the TOS on other websites to collect users personal info, and then you have nightmares about people taking that data from you? Doesn't that raise ethical concerns in your eyes?

Re: Personal and social information of 1.2B people discovered in data leak

#359

Post by lmilcin »

dtech wrote: post #256
lmilcin wrote: post #206

Earlier quoted context omitted.

That's incorrect. The usual way of using this service is to have backend network configured that connects your services that is not available from outside (ie you have to traverse through services to reach it). The so called "security" is just a paid feature for companies that want to use ElasticSearch but want to use it in "legacy" way because, presumably, they don't have people to design it correctly.

That's still really insecure, because it means that as soon as someone manages to gain any access to that network or any of the services on that network has a security issue your database is wide open. That means that if someone manages to get access to the. I'd say public internet with proper (encrypted) password auth is more secure than that.

If attacker has access to app server it is already game over. App server typically already has access to all of the data.

The pods are akin to localhost networking where there is only one externally available application with multiple networked components.

Re: Personal and social information of 1.2B people discovered in data leak

#360

Post by sailfast »

CydeWeys wrote: post #349
m00x wrote: post #334

Earlier quoted context omitted.

This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 . Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL inj…

"Software should be built in the best method of delivering maximum value to its users." Yes, and defaulting to insecure, thus repeatedly causing huge data breaches, is the exact opposite of delivering maximum value to users. It's delivering maximum liability .

I would argue that the single command to begin using the application and the ease of on boarding / querying data was a huge factor in expanding its usage. Elastic optimized for initial spin-up and getting things running fast. It works really well! Until you load it full of data on a public IP, that is.
Post reply on HN